feat(middleware): tighthten Content-Security-Policy

[nijel]

Proposed changes

Follow current best practices on most of the fields (we still use inline CSS, though).

Checklist

• [ ] Lint and unit tests pass locally with my changes.
• [ ] I have added tests that prove my fix is effective or that my feature works.
• [ ] I have added documentation to describe my feature.
• [ ] I have squashed my commits into logic units.
• [ ] I have described the changes in the commit messages.

Other information

[codecov[bot]]

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 90.61%. Comparing base (6aee586) to head (ed0acfb). Report is 2408 commits behind head on main.

Additional details and impacted files

[](https://app.codecov.io/gh/WeblateOrg/weblate/pull/11981?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=WeblateOrg) ```diff @@ Coverage Diff @@ ## main #11981 +/- ## ========================================== - Coverage 90.82% 90.61% -0.22% ========================================== Files 554 581 +27 Lines 57306 59095 +1789 Branches 9122 9437 +315 ========================================== + Hits 52046 53546 +1500 - Misses 3640 3851 +211 - Partials 1620 1698 +78 ``` | [Files](https://app.codecov.io/gh/WeblateOrg/weblate/pull/11981?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=WeblateOrg) | Coverage Δ | | |---|---|---| | [weblate/middleware.py](https://app.codecov.io/gh/WeblateOrg/weblate/pull/11981?src=pr&el=tree&filepath=weblate%2Fmiddleware.py&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=WeblateOrg#diff-d2VibGF0ZS9taWRkbGV3YXJlLnB5) | `73.00% <ø> (-0.14%)` | :arrow_down: | ... and [348 files with indirect coverage changes](https://app.codecov.io/gh/WeblateOrg/weblate/pull/11981/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=WeblateOrg)